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REMARKS 

Claims 1, 2, 4-13 and 20-46 stand rejected under 35 U.S.C. 102(b) as being anticipated by Chi 
(U.S. 5,978,91 7), claim 3 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over Chi, and 
further in view of Chambers (U.S. 5,398,196), and claims 14-19 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Chi. These rejections are respectfully disagreed with, and are 
traversed below. 

It is first noted that Chi and Chambers are referenced on page 2 of the Specification, where it is 
stated: 

"...U.S. Patent Nos. 5,398,196 and 5,978,917 teach the use of emulation in the 
analysis of potentially-malicious software. However, these prior art systems do 
not specifically involve an analysis of network-dependant behavior, or the 
emulation of activity or services on a network." 

The same argument is now repeated, incorporated by reference, and further developed below in 
support of the contention of the Applicants that claims 1-46, as filed, are patentable over Chi, or 
over Chi considered with Chambers. 

With regard to claim 1, the Examiner refers to col. 3, lines 25-33 and to col. 4, lines 64-66 for 
purportedly teaching: 

"an execution component for executing the software program, said execution 
component being coupled to an isolated network that does not have a direct 
connection to another network that is not an isolated network"; 

and to col. 4, lines 45-66 for purportedly teaching: 

"a network emulation component, coupled to said isolated network, for emulating 
the behavior of at least a host providing network services; wherein 

said execution component and said network emulation component cooperate with 
said isolated network in order to elicit a behavior of the software program that is 
detectable by said monitoring component." 

It is first pointed out that at col. 3, lines 20-25, Chi states only that: 
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"The present invention provides a generic method for identifying the presence of 
macro viruses and for eliminating those viruses from infected documents. This 
is achieved through use of heuristic emulation technology. The underlying 
method is to emulate the execution of macros within an isolated environment . 
The environment is set up such that it mimics as much as possible the 
environment within which a macro virus could normally propagate." (emphasis 
added) 

It is instructive to note that this is the only mention of "isolated" or "isolated environment" in the 
Chi patent, and there is certainly no mention of an "isolated network that does not have a direct 
connection to another network that is not an isolated network", as in claim 1 . 

It is further pointed out that what is actually stated at col. 4, lines 45-66 is the following: 

"FIG. 4 illustrates apparatus by which the present invention detects and eliminates 
macro viruses. Emulator 15 is located within computer 1 and executes from 
within computer 1 . Emulator 1 5 is coupled to the documents 1 1 generated by 
application program 5 and to global environment 13. Coupled to emulator 15 is 
detection module 1 7, which determines whether a macro virus is present based 
upon a preselected criterion or preselected criteria. Detection module 17 is 
coupled to user interface 7, so that it may announce its decisions concerning 
detection of macro viruses to the user. Coupled to detection module 1 7 is repair 
module 19, which eliminates macro viruses that have been determined by 
detection module 17 to be present. Since these viruses can appear in any 
document 11 or in the global environment 13, repair module 19 is coupled to all 
of the documents 1 1 and to global environment 13. 

In general, emulator 1 5 works by first emulating all of the tested macros assuming 
that they are located in global environment 13. All copies of macros to a local 
document 1 1 are noted. Then emulator 1 5 emulates the execution of all of the 
tested macros assuming that they are located in a local document 11." 

The "global environment" is defined in col. 2, at lines 26-31, as being: 

"an area within a storage medium that is associated with a particular application 
program and stores parameters and/or macros with said application program. For 
example, the global environment for a particular application program can contain 
text, graphics, and one or more macros." 
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In view of the foregoing, it is respectfully submitted that there is no mention in Chi of an 
" isolated network ", or of a " network emulation component , coupled to said isolated 
network, for emulating the behavior of at least a host providing network services ", or of any 
cooperation of an execution component and a network emulation component with an 
isolated network "in order to elicit a behavior of the software program that is detectable by 
said monitoring component". 

In that these are all elements of claim 1, it is thus asserted that Chi cannot anticipate claim 1 
under 35 U.S.C. 102(b) since for a rejection to be made on the basis of anticipation, it is well 
recognized that "to constitute an anticipation, all material elements recited in a claim must be 
found in one unit of prior art", Ex Parte Gould , BPAI, 6 USPQ 2d, 1680, 1682 (1 987), citing with 
approval In re Marshall 578 F.2d 301, 304, 198 USPQ 344, 346 (CCPA 1978). 

Further, since these various claimed elements are not found in Chi, then Chi cannot also be said 
to render claim 1 obvious or unpatentable under 35 U.S.C. 103(a). 

In that claim 1 is clearly not anticipated by Chi, and is also clearly patentable over Chi, then for 
at least this one reason alone the dependent claims 2-26 are also clearly patentable over Chi, 
whether considered alone or in combination with Chambers. 

The foregoing argument applies as well to independent claim 27, which is drawn to a system for 

eliciting a desired behavior from a software program, where the system comprises: 

"an emulated data communications network having at least one emulated network 
server coupled thereto , said at least one emulated network server responding to 
requests received from said emulated data communications network; 

an emulated host computer coupled to said emulated data communications 
network , said emulated host computer for executing the software program, the 
software program operating to originate requests to said emulated data 
communications network ; 

at least one emulated goat computer coupled to said emulated data 
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communications network; and 

at least one monitor for detecting an occurrence of the desired behavior in at least 
one of said emulated network server, said emulated host computer, and said at 
least one emulated goat computer ." (emphasis added) 

It is respectfully submitted that at least the highlighted subject matter shown above is not found 
in, is not disclosed in, and is not suggested by the system described by Chi. If the Examiner 
believes otherwise then he is respectfully requested to specifically point out where these elements 
are disclosed in Chi, since Chi has been cited as an anticipatory reference against claim 27. 

Further, since these various claimed elements are not found in Chi, then Chi cannot also be said 
to render claim 27 obvious or unpatentable under 35 U.S.C. 103(a). 

In that claim 27 is clearly not anticipated by Chi, and is also clearly patentable over Chi, then for 
at least this one reason alone the dependent claims 28-36 are also clearly patentable over Chi, 
whether considered alone or in combination with Chambers. 

Independent claim 37 is drawn to a computer program embodied on at least one computer- 
readable medium for executing a method for eliciting a behavior from a software program. In 
claim 37 the method is said to comprise: 

" emulating a data communications network having at least one emulated network 
server coupled thereto, said at least one emulated network server operating to 
respond to requests received from said emulated data communications network : 

emulating a host computer coupled to said emulated data communications 
network , said emulated host computer executing the software program, the 
software program operating to originate requests to said emulated data 
communications network : and 

detecting an occurrence of the behavior in at least one of said emulated network 
server and said emulated host computer." 
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It is also respectfully submitted that at least the highlighted subject matter shown above is not 
found in, is not disclosed in, and is not suggested by the system described by Chi. If the Examiner 
believes otherwise then he is respectfully requested to specifically point out where these elements 
are disclosed in Chi, since Chi has been cited as an anticipatory reference against claim 37. 

Further, since these various claimed elements are not found in Chi, then Chi cannot also be said 
to render claim 37 obvious or unpatentable under 35 U.S.C. 103(a). 

In that claim 37 is clearly not anticipated by Chi, and is also clearly patentable over Chi, then for 
at least this one reason alone the dependent claims 38-46 are also clearly patentable over Chi, 
whether considered alone or in combination with Chambers. 

The foregoing arguments have concentrated on the patentability of the independent claims 1,27 
and 37 and, in so doing, have simultaneously and clearly established the patentability of the 
dependent claims. However, should the Examiner persist in maintaining this rejection, the 
Applicants reserve the right to argue the patentability of each of the dependent claims 
individually. 

The Examiner is respectfully requested to reconsider and remove the expressed rejections, and 
to allow claims 1 -46 as originally filed. However, should there be any remaining issue that would 
impede the allowance of all of the pending claims, then the Examiner is respectfully requested 
to contact the undersigned attorney through any of the means set forth below. 
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